Docker operations pack

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

sudo emisar pack install docker --hash sha256:f077d57ea1dcca3a6669bab8a913851eb9a2a577491913ebe63e0c796aa2ebee

Setup

Talks to the local Docker daemon on the runner host via its Unix socket — no credentials needed.

sudo usermod -aG docker emisar
sudo systemctl restart emisar

id -nG emisar | tr ' ' '\n' | grep -Fx docker
sudo -u emisar docker info >/dev/null

sudo emisar pack verify docker

Install and configure a pack walks through the whole sequence on a host.

• docker.compose_config script low Low — read-only or trivially reversible

  Summarize a Docker Compose configuration

  Parse one contained Compose file without interpolation or environment resolution, then return only service, image, network, volume, and profile names as sorted, capped samples with per-list truncation counts. Raw YAML, environment values, secrets, labels, and build arguments are never returned.

  View source on GitHub
• docker.compose_images script low Low — read-only or trivially reversible

  docker compose images

  List images used by containers already created for one contained Compose project. This reports container image IDs and tags, not configured image references for services that have never been created.

  View source on GitHub
• docker.compose_logs exec medium Medium — changes state, easily reversible

  docker compose logs (last N lines)

  Return the last N lines of logs for one service in a compose project. Read-only.

  View source on GitHub
• docker.compose_ls exec low Low — read-only or trivially reversible

  docker compose ls --all

  List all known Compose projects, including projects with stopped containers, with their status and resolved configuration-file paths.

  View source on GitHub
• docker.compose_ps exec low Low — read-only or trivially reversible

  docker compose ps -a

  List services in a compose project (running + stopped). The compose-file path is required and pattern-restricted. Read-only.

  View source on GitHub
• docker.compose_restart exec high High — service-affecting

  docker compose restart (one service)

  Restart ONE service in a compose project. SIGTERM with the configured stop_grace_period, then SIGKILL, then start. In-flight requests are dropped.

  View source on GitHub
• docker.container_top exec low Low — read-only or trivially reversible

  docker top (processes inside a container)

  List processes running inside one container (via `docker top`). Use when the container's CPU is hot but you don't know which child process is the offender. Read-only.

  View source on GitHub
• docker.events_tail script low Low — read-only or trivially reversible

  docker events — lifecycle + failures (bounded window)

  Replay docker daemon events from the last N minutes, focused on container lifecycle and failures (create, start, restart, stop, die, kill, oom, destroy, health_status) — the "why did the container restart / OOM / go unhealthy?" read. Routine health-check exec_* chatter is excluded by default so the real signal is not drowned out; set include_exec=true to add exec_create/exec_start/ exec_die. Read-only.

  View source on GitHub
• docker.image_history exec high High — service-affecting

  docker history

  Return the layer-by-layer build history of one image — useful for tracing "where did this 2 GB layer come from?" Read-only. History runs with --no-trunc, so CREATED BY lines carry the complete Dockerfile commands, including any `ENV`/`ARG` secret a badly-built image baked in; the runner's redaction is a pattern-bound backstop, not a guarantee.

  View source on GitHub
• docker.image_inspect exec high High — service-affecting

  docker image inspect

  Return the full JSON inspect document for one image — labels, config, exposed ports, build history root, and the image's baked-in env. Image env is build-time config, but a badly-built image can bake a secret in; the runner's redaction is a pattern-bound backstop. Read-only.

  View source on GitHub
• docker.images exec low Low — read-only or trivially reversible

  docker images

  List images on the host. Use to verify expected tags are present before a deploy or to find old images consuming disk. Read-only.

  View source on GitHub
• docker.info exec low Low — read-only or trivially reversible

  docker info

  Show daemon info with `docker info` — daemon version, storage driver, total containers/images, host resources. Read-only.

  View source on GitHub
• docker.inspect exec high High — service-affecting

  docker inspect (one container)

  Return the full JSON inspect document for one container — state, exit code, restart count, mounts, network config, labels, and the container's env. The env commonly carries injected secrets (DB URLs, API keys, values passed with -e), so this is approval-gated; the runner's redaction is a fail-closed backstop, not a guarantee — it is pattern-bound and can miss a bespoke secret. Container name is pattern-restricted. Read-only.

  View source on GitHub
• docker.kill exec high High — service-affecting

  docker kill (signal)

  Send a Unix signal to one container's main process. Default is SIGKILL — immediate, no graceful drain. Specify `signal:` for SIGTERM (graceful) or SIGHUP (reload).

  View source on GitHub
• docker.logs exec medium Medium — changes state, easily reversible

  docker logs (last N lines)

  Return the last N log lines for one container. Container name is pattern-restricted to alnum + "_-.". Read-only. Output passes through the runner's redaction pipeline.

  View source on GitHub
• docker.network_inspect exec low Low — read-only or trivially reversible

  docker network inspect

  Return the JSON inspect document for one network — subnet, gateway, containers attached, driver options. Read-only.

  View source on GitHub
• docker.network_ls exec low Low — read-only or trivially reversible

  docker network ls

  List all docker networks with driver + scope. Read-only.

  View source on GitHub
• docker.ps exec low Low — read-only or trivially reversible

  docker ps -a

  List all containers (running + stopped). Returns id, image, status, ports, names. Always includes stopped containers — for triage you almost always want to see the dead ones too. Read-only.

  View source on GitHub
• docker.pull_image exec medium Medium — changes state, easily reversible

  docker pull

  Pull one image from its configured registry. Network + disk intensive; image-ref restricted to safe characters. Idempotent — re-pulling an existing tag re-checks the digest.

  View source on GitHub
• docker.restart exec high High — service-affecting

  docker restart (one container)

  Restart one container. Sends SIGTERM, waits for the configured stop-timeout, then SIGKILL, then re-starts. In-flight requests are dropped; the container's restart policy still applies after this call. Container name is pattern-restricted.

  View source on GitHub
• docker.stats exec low Low — read-only or trivially reversible

  docker stats (one shot)

  Capture one frame of `docker stats` (CPU%, mem usage/limit, net I/O, block I/O, PIDs) for every running container. Read-only.

  View source on GitHub
• docker.stop exec high High — service-affecting

  docker stop (one container)

  Stop one container — SIGTERM, then SIGKILL after the configured timeout. Container stays around (for inspection/restart). Use `docker.kill` for immediate SIGKILL.

  View source on GitHub
• docker.system_df exec low Low — read-only or trivially reversible

  docker system df

  Report disk usage by docker (images, containers, volumes, build cache). Use to plan a prune. Read-only.

  View source on GitHub
• docker.system_prune exec high High — service-affecting

  docker system prune

  Remove stopped containers, dangling images, and unused networks. Does NOT remove unused volumes (intentional — volume data is the riskiest thing to delete). Run `docker.system_df` first to scope what will be freed. Irreversible.

  View source on GitHub
• docker.version exec low Low — read-only or trivially reversible

  docker version

  Return client + server version, API version, build info. Read-only.

  View source on GitHub
• docker.volume_inspect script low Low — read-only or trivially reversible

  docker volume inspect

  Show one volume's driver, scope, mountpoint, creation time, and labels, projected from `docker volume inspect`. Driver options and driver status are never returned — CIFS/NFS and plugin volume options can carry mount credentials. Read-only.

  View source on GitHub
• docker.volume_ls exec low Low — read-only or trivially reversible

  docker volume ls

  List all named docker volumes. Read-only.

  View source on GitHub
• docker.volume_prune exec critical Critical — data loss or irreversible

  docker volume prune (DESTRUCTIVE)

  Remove every volume not attached to a container. **Permanently deletes the data on them.** Use only on caches and dev hosts. Pair with `docker.volume_ls` first to confirm what's loose.

  View source on GitHub